When investigating the cause of a cybersecurity crisis, “You can’t improve what you can’t reconstruct and what you’ve forgotten,” stated Marie Hargraves, Principal Crisis Management Consultant at Semperis. Adding, organisations build genuine cyber resilience not during the acute phase of an incident, but in the post-incident review that follows it.

Hargraves, who supported and exercised national crisis and incident response teams across government and healthcare sectors in the United Kingdom, said real-time documentation captured during a crisis is central to making that review effective.

The approach: applying the concept of continual service improvement to a crisis. Examining where an organisation’s processes, people or technology fell short. That might mean an escalation path that was missing, or an unplanned piece of shadow IT that only became apparent once the organisation was forced to work around it. 

“It should be part of your crisis plan, it shouldn’t be separated,” said Hargraves. “The post-incident review should happen straight away.”

She said a mature organisation would typically aim to close most gaps in its people, processes and technology within six months of an incident, though full recovery can take longer where digital infrastructure has been affected, and staff have had to revert to manual processes in the interim. A separate challenge then emerges when digital systems come back online: someone has to transfer manual records and processes back into digital systems, a task she said is often overlooked in recovery planning.

Semperis’s crisis management platform, Ready1, is designed to operate independently of an organisation’s main IT and communication systems, so that it remains usable if a network is degraded or compromised during an incident. Hargraves said the tool automatically timestamps actions and tasks in both GMT and local time as a crisis unfolds, which she said matters for organisations with a global footprint, and allows teams to manually add context around decisions as they are made.

“If anyone has ever been in a [cyber] crisis, you’ll know that memory degrades quickly during high-pressure incidents. Critical decisions, assumptions, and pivots are often lost if they’re not documented as events unfold. This is where the resilience happens post-incident. So it’s these nuances and these pivots that, if you can document them in real time in one single source of truth, you’re going to be able to look at those lessons identified and action them, which is going to increase your resilience overall,” she said.

The platform stores contact details, cyber insurance policies and third-party retainer information that teams often struggle to locate quickly during a live incident, alongside documents that remain accessible even if an organisation’s own network is unavailable. This extends to verifying, in advance, that contacts such as a firewall vendor or retainer partner are still current, rather than an organisation discovering during a crisis, in the early hours of the morning, that a contact has since left the role.

The aim is to allow any team involved in a crisis, whether cyber, legal or finance, to reconstruct a full and accurate timeline of what happened once the incident has ended, using a single record rather than piecing one together from separate systems and handover notes.

Hargraves worked within the UK Home Office Digital Data and Technology Directorate, and said the experience shaped her approach to post-incident review at Semperis. She contrasted this with what she described as a common pattern in organisational exercises, where teams run a scheduled test every six months without anyone committing to a decision, then repeat the same exercise later having changed little, often because staff are reluctant to take ownership of a call.

She said she would instead re-exercise her team against a previous real crisis roughly every six months, testing whether lessons identified at the time had actually been acted upon. She said this mattered because of high turnover in cybersecurity functions, citing what she described as an average turnover of around 40 per cent a year in security operations centres, which she said meant lessons risked being lost if they were not embedded into process rather than left with the individuals who identified them.

Hargraves was supporting incident response during the SolarWinds Orion compromise in 2021, which she described as a supply-chain failure with dependencies across many systems that few organisations had anticipated. She said the episode underlined the need for organisations to complete business impact analysis in advance of a crisis, understanding which dependencies exist and what losing them would mean, rather than discovering that during the incident itself.

Organisations need to translate technical detail into terms the wider business understands, framing incidents around business outcomes rather than purely technical detail, so that leadership, operational teams and cyber specialists are working from the same account of events. She said this is only possible if the decisions and context behind them are captured as they happen, rather than reconstructed from memory afterwards.

“I think communication is one of the biggest cybersecurity vulnerabilities we have, because we are still siloing digital teams from the operational businesses,” said Hargraves. ” So perhaps we need to get a little bit better at positioning how we’re talking through a crisis and put it into terms of business outcomes, so we’re all talking the same language.”

Leon, founded in London in 2004, built its reputation on a menu of “naturally fast food”, offering salads, wraps, hot boxes and breakfast dishes marketed as a fresher, healthier alternative to traditional fast food.

The chain expanded rapidly in city centres, railway stations and transport hubs, but has struggled in recent years with rising costs, changing trading conditions and the shift towards working from home.

Leon formerly had an Oxford branch on Cornmarket Street which opened in 2018, but this closed two years ago as part of a wider shake‑up of the estate, leaving local customers without a dedicated site in the city.

READ MORE: Millions in UK face surprise HMRC tax bill as July deadline nears

The company went into administration in December after coming under mounting financial pressure, with insolvency specialists from BTG Advisory and Quantuma brought in to examine options for the business.

Restructuring experts including Brian Burke and Michael Kiely at Quantuma, and Andrew Andronikou at BTG Advisory, were tasked with overseeing the process and finding a way to keep the business trading rather than breaking it up.

They inherited a brand that had already been downsized once during the pandemic, when a Company Voluntary Arrangement (CVA) in 2020 was used to cut rents and preserve hundreds of jobs, but the post‑Covid landscape proved even more challenging.

By late 2025, founder John Vincent had bought Leon back from its previous owners, yet high inflation, weaker commuter footfall and what the company has described as “unsustainable” tax burdens left the chain losing millions of pounds a year and carrying significant net liabilities.

READ MORE: ‘Panting’ dog left in vehicle with windows closed in Waitrose car park

After entering administration, advisers moved quickly to close underperforming stores and reduce costs, with 22 locations shutting and more than 200 roles cut as part of a turnaround drive.

The latest restructuring programme has now culminated in a fresh CVA, backed unanimously by voting creditors including HM Revenue & Customs, which will allow Leon to exit administration with 43 restaurants, 23 of them franchises.

Quantuma says more than 530 jobs have been secured across Leon’s head office, central support and trading site teams, with the CVA focused on removing loss‑making stores, renegotiating rents and giving the brand a platform for “ambitious development plans” rather than a fire‑sale of assets.

For Oxfordshire customers, Leon’s closest remaining outlets are now in London and other major cities, but the company has signalled that – once the turnaround is complete – it wants to grow again, opening the door to future openings in commuter hubs serving the county.

Ecommpay has published a playbook on reducing failed subscription payments, which it says cost subscription businesses an average of 9% of revenue.

The payments company argues that billing-system problems are pushing some customers to cancel services they intended to keep. Its analysis found that 7% of recurring charges fail on the first attempt, while consumers are also reviewing their subscriptions more closely.

The report focuses on what Ecommpay calls “invisible retention” – payment recovery processes designed to stop avoidable failures from turning into lost subscribers. It says the issue often stems from expired card details, temporary lack of funds and network timeouts, rather than dissatisfaction with the product or service.

That matters as subscription businesses face tighter consumer protection rules in the UK. New rules under the Digital Markets, Competition and Consumers Act will require greater transparency, renewal reminders and simpler cancellation processes.

Ecommpay says its approach is intended to work alongside those rules, not replace them. Customers, it says, must continue to have visibility over subscriptions and the ability to cancel at any time.

Roy Blokker, Head of Strategic Sales at Ecommpay, said the industry has focused too heavily on winning customers while neglecting payment failures that can quietly erode revenue.

“Subscription businesses have spent years chasing acquisition, but many are failing to plug the quiet leak of failed payments,” Blokker said.

“It is, of course, right that consumers can cancel a subscription if they no longer want the product or service. But many do not leave because the product disappoints them. Sometimes they leave because the payment layer gives them a reason to reconsider.

“The next subscription growth advantage will not come from another discount or win-back campaign. It will come from payment infrastructure that keeps customers connected when billing fails in the background. We call this invisible retention.”

Four areas

The playbook identifies four areas that can improve payment recovery in recurring billing: automated retries, network tokenisation, Direct Debit and Variable Recurring Payments through open banking.

On retries, Ecommpay says merchants should move beyond fixed schedules and instead use decline-code analysis and salary-cycle data to time another payment attempt when success is more likely. Its retry system, it says, can recover 15% to 30% of transactions that fail initially before the customer needs to take manual action.

It also points to tokenisation as a way to reduce disruption when cards expire, are lost or are replaced. Merchants using its tokenised subscription system are seeing renewal success rates improve by as much as 3%, according to comparative merchant data cited by the company.

For higher-value or business-to-business subscriptions, Ecommpay makes the case for Direct Debit over cards. It says Bacs and SEPA Direct Debit can offer greater stability for recurring collections, with success rates above 95% when programmes are managed well, while also lowering processing costs on larger transactions.

The fourth option is Variable Recurring Payments, or VRPs, based on open banking. Ecommpay says these let customers authorise recurring payments within limits they set and manage through their banking app, while giving merchants immediate settlement and avoiding card expiry problems.

Consumer control

Ecommpay repeatedly refers to customer control in its analysis, reflecting the wider regulatory debate around subscriptions. It says payment recovery should not interfere with the right to cancel, but instead help ensure customers who want to continue are not lost because of avoidable technical or administrative issues.

That distinction is likely to become more important as policymakers and regulators scrutinise renewal practices and cancellation journeys. Businesses that depend on recurring revenue are under pressure to make subscription terms easier to understand and easier to exit.

Ecommpay was founded in London in 2012 and provides payment processing, acquiring and orchestration services. It offers card payments, open banking tools, recurring billing and Direct Debit products through a single application programming interface.

Its analysis suggests that, for subscription businesses, payment operations are becoming more closely tied to customer retention rather than serving only as a back-office function. Failed-payment handling, it argues, can determine whether a subscriber remains active or uses a billing prompt as a reason to review and cancel a service.

For merchants, that puts greater focus on how retries are timed, how stored payment details are maintained and whether alternatives to card billing should play a larger role in recurring payments. For customers, the aim is to avoid disruption while preserving “full visibility of their subscriptions and the ability to cancel at any time”.